What is 21 CFR 11 and why is it so complicated?

When Title 21 of the Code of Federal Regulation Part 11 went into effect in 1997, software providers were left wondering what it would do to their business practices and how it would change their processes. 21 CFR Part 11 is a section in the Code of Federal Regulations (CFR) that sets forth the FDA guidelines on using electronic records and electronic signatures. Each title of the CFR addresses a different regulated area, 21 CFR relates to Pharmaceuticals and Medical Devices and Part 11 covers electronic records and electronic signatures.

To simplify, Part 11 ensures that companies and organizations implement good business practices by defining the criteria under which electronic records and signatures are considered to be accurate and authentic as compared to paper records and handwritten signatures.

According to the leading provider of life science consultants, Montrium, there are three main areas in which FDA regulated companies must look at as primary areas of focus when addressing 21 CFR Part 11:

• Features of Your System – In accordance with 21 CFR Part 11 there are a range of features that you are required to have in place when implementing a computer system to manage electronic records and processes. Assurances for audit trail functionality, electronic signatures, security, and data integrity, records retention and file formats to name a few.
• Standard Operating Procedures – As with all regulated industries, the companies that operate within them use Standard Operating Procedures (SOP’s) to govern and describe their processes. Currently, in accordance with Part 11, there are around 9 IT SOP’s needed to address the IT Infrastructure requirements.

• System Validation – When implementing an electronic system for the use in regulated activities, you have to ensure that you document that the electronic system is fit for its intended use. In other words, demonstrate that your system does what it should do. You must also have controls in place that allow you to identify when the system doesn’t function as per its intended use. Here you should be utilizing your SOP’s and industry best practices to facilitate the validation process.

When this code came out, most companies that it applied to were not excited, to say the least. Complying with Part 11 would mean changing processes, adding expenses, plus initial confusion over what parts applied to which procedures. In response, the FDA released a document to serve as a guide for observing Part 11. It has been updated through the years and the FDA has continued to release further guidance documents. The current rules were implemented as of April 2017.

What happens if you don’t follow 21 CFR Part 11?

FDA inspectors make regular visits to ensure that companies are in compliance with this regulation. If something does not comply, they will issue a Form 483. This is a warning, saying you need to correct certain areas. For the past several years, the FDA has issued around 5,000 483s annually.

It is important that everyone in the company, regardless of authority level, understands 21 CFR Part 11 and the key benefits that the regulation can bring to the organization.